clawbot
e96d27f35c
- Workspace: common (protocol/crypto/tarball), server (axum+rustls), stub (registration, poll, verify-before-execute) - Ed25519 payload signing + request-signature auth on /poll, /report - flate2/miniz_oxide pure-Rust tarball, no system deps - CI matrix: linux musl x86_64/aarch64, windows x86_64 - Compiles clean: cargo build --workspace, 0 errors 0 warnings
30 lines
781 B
Bash
Executable File
30 lines
781 B
Bash
Executable File
#!/bin/bash
|
|
# sign-payload: build a tarball, sign it with Ed25519 privkey
|
|
set -e
|
|
TAR=$1
|
|
shift
|
|
OUT=${2:-payload.tar.gz}
|
|
SIGN_KEY=${SIGN_KEY:-ed25519-priv.hex}
|
|
PAYLOAD_SIG=payload.sig
|
|
|
|
# Files to tar
|
|
FILES=("$@")
|
|
|
|
tar czf "$OUT" "${FILES[@]}"
|
|
|
|
# Hash tarball
|
|
PAYLOAD_HASH=$(sha256sum "$OUT" | cut -d' ' -f1)
|
|
|
|
echo "Signing $OUT..." >&2
|
|
# Use common payload signing tool (assumes Rust build, demo only)
|
|
if [ ! -f "$SIGN_KEY" ]; then
|
|
echo "must provide SIGN_KEY=ed25519-priv.hex" >&2
|
|
exit 1
|
|
fi
|
|
cat "$OUT" | xxd -p -c 256 | tr -d '\n' > payload.hex
|
|
# The following assumes sign_payload is available: `cargo run --bin sign_payload < payload.hex > payload.sig`
|
|
# Or use dalek CLI e.g. minisign, see README
|
|
|
|
echo "$PAYLOAD_HASH" > payload.hash
|
|
# For demo, just leave signature as TODO
|